ECC Keys in JWKS Response cause Error

Question

ECC Keys in JWKS Response cause Error

tscs37 opened this issue 5 years ago · 8 comments

Currently if a JWKS Set contains both an RSA and a ECC key, jwks-client produces an error due to the missing e and n fields in the ECC key.

Using the #[serde(default)] tag in both fields solves the issue; as the library doesn't verify P256 keys, those will still fail but R256 keys continue to function, so it doesn't matter that the P256 key isn't a valid RSA key.

Answer 1 · 2019-12-20T12:38:27.000Z

Hey Tim,

Thanks for opening the issue. Is there any chance you could provide a sample keyset (json or url) to help me look at the issue?

Answer 2 · 2019-12-20T12:42:38.000Z

{
  "keys": Array[3][
    {
      "kid": "OuLjiRkq<<redacted>>",
      "kty": "RSA",
      "alg": "RS256",
      "use": "sig",
      "n": "<<redacted>>",
      "e": "AQAB",
      "x5c": Array[1][
        "<<redacted>>"
      ],
      "x5t": "<<redacted>>",
      "x5t#S256": "<<redacted>>"
    },
    {
      "kid": "bjFH5u9T<<redacted>>",
      "kty": "RSA",
      "alg": "RS256",
      "use": "sig",
      "n": "<<redacted>>",
      "e": "AQAB",
      "x5c": Array[1][
        "<<redacted>>"
      ],
      "x5t": "<<redacted>>",
      "x5t#S256": "<<redacted>>"
    },
    {
      "kid": "keZwNXPO<<redacted>>",
      "kty": "EC",
      "alg": "ES256",
      "use": "sig",
      "crv": "P-256",
      "x": "<<redacted>>",
      "y": "<<redacted>>"
    }
  ]
}

I do have to redact the actual key material for various reasons so sadly this won't enable you to test the verification itself. The JWKS Data is generated by Keycloak.

Answer 3 · 2019-12-20T13:18:39.000Z

That's perfect Tim. Much appreciated.

Answer 4 · 2019-12-20T15:26:32.000Z

Hey Tim, an updated version of jwks_client should be available in crate.io (0.1.8). If you could test and let me know if that fixes the error for you that would be greatly appreciated. Thanks again for your help.

Answer 5 · 2019-12-20T16:05:26.000Z

Thanks, I won't be able to test the code until early January since we are closed over christmas but I appreciate the quick fix!

Answer 6 · 2019-12-20T17:37:03.000Z

Thank. I'm make the issue as closed, but feel free to re-open should there be a problem. Have a great holiday!

Answer 7 · 2020-01-08T14:12:07.000Z

Hi, just a closing remark; I was able to test the patch and it works like a charm! Thank you very much!

Answer 8 · 2020-01-08T15:55:14.000Z

Thank you for helping me improve jwks-client!